diff --git a/src/debian/debian_ts_nftables.conf b/src/debian/debian_ts_nftables.conf
index 1abe1b8..4e3dafd 100644
--- a/src/debian/debian_ts_nftables.conf
+++ b/src/debian/debian_ts_nftables.conf
@@ -34,7 +34,8 @@ table inet router {
 
     chain forward {
         type filter hook forward priority filter; policy drop;
-        ct state established,related goto handle_offload comment "defconf: handle forwarded flows"
+        ct state established,related flow add @ft comment "defconf: track forwarded flows"
+        ct state vmap { established : accept, related : accept, invalid : drop } comment "defconf: handle forwarded flows"
         iifname "eth0" jump forward_lan comment "defconf: handle LAN IPv4 / IPv6 forward traffic"
         iifname "tailscale0" jump forward_tailscale comment "tsconf: handle TS IPv4 / IPv6 forward traffic"
     }
@@ -52,11 +53,6 @@ table inet router {
         counter drop comment "defconf: drop excess new TCP connections"
     }
 
-    chain handle_offload {
-        flow add @ft accept comment "defconf: track forwarded flows"
-        accept
-    }
-
     chain input_lan {
         ct status dnat accept comment "lanconf: accept port redirect"
         jump accept_from_lan
@@ -77,7 +73,6 @@ table inet router {
     }
 
     chain accept_to_lan {
-        meta nfproto ipv4 oifname "eth0" ct state invalid counter drop comment "defconf: prevent LAN NATv4 leakage"
         oifname "eth0" accept comment "defconf: accept LAN IPv4 / IPv6 traffic"
     }